Threat Entry Updated 2024-11-21

CVE-2022-1574 - Html2wp Plugin

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server

PLUGIN Html2wp

CVE-2022-1574

CRITICAL CVSS 9.8 2022-06-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-1572 - Html2wp Plugin

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file

PLUGIN Html2wp

CVE-2022-1572

HIGH CVSS 8.1 2022-06-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-1573 - Html2wp Plugin

The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them

PLUGIN Html2wp

CVE-2022-1573

MEDIUM CVSS 4.3 2022-06-27

Risk Score

Open Full Technical Breakdown